stealc | 00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b

General

Target

00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe
Size

205KB
MD5

46a221059a8fae9bbbc96fdf1f794884
SHA1

8917f7e3f471c5eaa6fb8a026236fd229b4e3af3
SHA256

00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b
SHA512

b6914b29eebed8592c3c8974969b127ad07a0b147126d0656959ff9175a7da5e989a0cf2fdd4883c777aa98f8cae7382cc2247676526f975390693ee5342aa3b
SSDEEP

3072:nXYvri+tmY5sIFxuwQJXYG01XslEjKaflcpYVM6AjnJaYe53MDk2UKYzEO:nXYvu2mYAlal5lcpR6AjIKyEO

Score

10^/10

stealc default discovery stealer

Malware Config

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes

url_path
/c4754d4f680ead72.php

Signatures

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	1944	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 2244 wrote to memory of 1944	2244	00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe	29
PID 1944 wrote to memory of 2260	1944	RegAsm.exe	30
PID 1944 wrote to memory of 2260	1944	RegAsm.exe	30
PID 1944 wrote to memory of 2260	1944	RegAsm.exe	30
PID 1944 wrote to memory of 2260	1944	RegAsm.exe	30

C:\Users\Admin\AppData\Local\Temp\00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe
"C:\Users\Admin\AppData\Local\Temp\00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 252
    3⤵
    - Program crash
    PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-7-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1944-11-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1944-13-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1944-16-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1944-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1944-6-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1944-5-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1944-4-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1944-3-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2244-1-0x0000000001200000-0x0000000001238000-memory.dmp

Filesize
224KB

Download
memory/2244-0-0x0000000074ABE000-0x0000000074ABF000-memory.dmp

Filesize
4KB

Download
memory/2244-14-0x0000000074AB0000-0x000000007519E000-memory.dmp

Filesize
6.9MB

Download
memory/2244-17-0x0000000074AB0000-0x000000007519E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing